Method for directing requests to trusted resources
The present invention enables an enterprise to move from an implicitly trusted resource pool to an explicitly authenticated resource pool. Trust information is generally conveyed whenever a new resource is added to the pool and trust information is revoked when a resource is removed from the pool or is unable to provide its advertised resources. The dynamic, event driven conveyance of trust information is particularly important in highly virtualized environments where virtual resources are dynamically scaled up and down in response to resource demand.
1. A method comprising the steps of:
providing a plurality of network resources ( 10 );
each network resource ( 10 ) of said plurality of network resources ( 10 ) using transport access control to convey an authentication object ( 14 ) to a trust director ( 16 );
said transport access control providing authentication without first requiring the establishment of a TCP session which strengthens the security of each of said plurality of network resources ( 10 );
said trust director ( 16 ) using said conveyed authentication object ( 14 ) to authenticate each of said plurality of network resources ( 10 );
providing a network client ( 18 );
said network client ( 18 ) conveying a resource request ( 20 ) to said trust director ( 16 );
said trust director ( 16 ) selecting one of said authenticated plurality of network resources ( 10 A) that matches said conveyed resource request ( 20 ); and
said trust director ( 16 ) conveying said conveyed resource request ( 20 ) to said selected authenticated network resource ( 10 SA).
2. A method as recited in claim 1 , in which:
said authentication object ( 14 ) includes identity information.
3. A method as recited in claim 1 , in which:
said network resource ( 10 ) includes a unique identity ( 12 ).
4. A method as recited in claim 1 , in which:
the authentication of said network resource expires after a period of time.
5. A method as recited in claim 1 , in which:
the selection of one of said authenticated plurality of network resources ( 10 ) is based on a number of resource requests currently pending on each of said plurality of network resources.
6. A method as recited in claim 1 , in which:
the selection of one of said authenticated plurality of network resources ( 10 ) is based on a statistical distribution that results in the selection of said selected authenticated network resource ( 10 SA) for every resource request by said network client.
7. A method as recited in claim 1 , which includes the additional steps of:
determining if each of said authenticated plurality of network resources ( 10 ) is presently able to provide an advertised resource when a resource request is presented to it; and revoking said authentication of network resource when said network resource is unable to provide said advertised resource when requested.
8. A method as recited in claim 1 , which includes the additional steps of:
indicating said selected authenticated network resource ( 10 SA) to a management entity ( 24 ).
9. A method as recited in claim 1 , in which:
said conveyance of said resource request ( 20 ) from said trust director ( 16 ) to said selected authenticated network resource ( 10 SA) is indicated by editing a destination address of said resource request ( 20 ) to indicate an destination address of said selected authenticated network resource ( 10 SA).
10. A method as recited in claim 1 , in which:
said conveyance of said resource request ( 20 ) from said trust director ( 16 ) to said selected authenticated network resource ( 10 SA) is indicated by editing the destination port number of said resource request ( 20 ) to indicate a destination port number of said selected authenticated network resource ( 10 SA).
11. A method comprising the steps of:
providing a plurality of network resources ( 10 );
each network resource ( 10 ) of said plurality of network resources ( 10 ) conveying an authentication object ( 14 ) to a trust director ( 16 );
said trust director ( 16 ) using said conveyed authentication object ( 14 ) to authenticate each of said plurality of network resources ( 10 );
providing a network client ( 18 );
said network client ( 18 ) using transport access control to convey a resource request ( 20 ) to said trust director ( 16 );
said transport access control providing authentication without first requiring the establishment of a TCP session which strengthens the security of said network client ( 18 );
said resource request ( 20 ) containing a second authentication object ( 14 );
said trust director ( 16 ) using said second authentication object ( 14 ) to authenticate said network client ( 18 );
said trust director ( 16 ) selecting one of said authenticated plurality of network resources ( 10 A) that matches said conveyed resource request ( 20 ); and
said trust director ( 16 ) conveying said conveyed resource request ( 20 ) to said selected authenticated network resource ( 10 SA).
12. A method as recited in claim 11 , in which:
said second authentication object ( 14 ) includes identity information.
13. A method as recited in claim 11 , in which:
said network client ( 18 ) includes a unique client identity ( 12 C).
14. A method as recited in claim 11 , in which:
said network resource ( 10 ) includes a unique identity ( 12 ).
15. A method as recited in claim 11 , in which:
said authentication of said network resource expires after a period of time.
16. A method as recited in claim 11 , in which:
the selection of one of said authenticated plurality of network resources ( 10 ) is based on the number of resource requests currently pending on each of said plurality of network resources.
17. A method as recited in claim 11 , in which:
the selection of one of said authenticated plurality of network resources ( 10 ) is based on a statistical distribution that results in the selection of said selected authenticated network resource ( 10 SA) for every resource request by said network client.
18. A method as recited in claim 11 , which includes the additional steps of:
determining if each of said authenticated plurality of network resources ( 10 ) is presently able to provide an advertised resource when said resource request is presented to it; and revoking said authentication of network resource when said network resource is unable to provide said advertised resource when requested.
19. A method as recited in claim 11 , which includes the additional steps of:
indicating said selection to a management entity ( 24 ).
20. A method as recited in claim 11 , in which:
said authentication object ( 14 ) contained in said resource request ( 20 ) is a statistical object ( 26 ).
21. A method comprising the steps of:
providing a plurality of network resources ( 10 );
each network resource ( 10 ) of said plurality of network resources ( 10 ) conveying an authentication object ( 14 ) to a trust director ( 16 );
said trust director ( 16 ) using said conveyed authentication object ( 14 ) to authenticate each of said plurality of network resources ( 10 );
providing a network client ( 18 );
said network client ( 18 ) using transport access control to convey a resource request ( 20 ) to said trust director ( 16 );
said transport access control providing authentication without first requiring the establishment of a TCP session which strengthens the security of said network client ( 18 );
said resource request ( 20 ) containing a second authentication object ( 14 );
said trust director ( 16 ) failing to authenticate said network client ( 18 ) using said second authentication object ( 14 ); and
said trust director ( 16 ) processing said conveyed resource request ( 20 ) in accordance with a trust policy ( 22 ).
22. A method as recited in claim 21 , in which:
said second authentication object ( 14 ) includes identity information.
23. A method as recited in claim 21 , in which:
said network resource ( 10 ) includes a unique identity ( 12 ).
24. A method as recited in claim 21 , in which:
the authentication of said network resource expires after a period of time.
25. A method as recited in claim 21 , which includes the additional steps of:
determining if each of said authenticated plurality of network resources ( 10 ) is presently able to provide an advertised resource when a resource request is presented to it; and revoking said authentication of network resource when said network resource is unable to provide said advertised resource when requested.
26. A method as recited in claim 21 , in which:
said trust policy ( 22 ) includes discarding said resource request ( 20 ).
27. A method as recited in claim 21 , in which:
said trust policy ( 22 ) includes conveying said resource request ( 20 ) to a management entity ( 24 ).